From 5aef41663ab7da5b02e3c5871adb8b39213778f9 Mon Sep 17 00:00:00 2001
From: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
Date: Sun, 24 Jul 2022 12:12:26 +0300
Subject: [PATCH] backends/drm: Fix potential use-after-free

When the output is removed, there are legit cases when the connector can
be still accessed.

CCBUG: 457002
---
 src/backends/drm/drm_gpu.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/backends/drm/drm_gpu.cpp b/src/backends/drm/drm_gpu.cpp
index 25d7bb585c..8f0fe8c4ca 100644
--- a/src/backends/drm/drm_gpu.cpp
+++ b/src/backends/drm/drm_gpu.cpp
@@ -313,12 +313,12 @@ bool DrmGpu::updateOutputs()
             pipeline->revertPendingChanges();
         }
         for (const auto &output : qAsConst(addedOutputs)) {
+            removeOutput(output);
             const auto it = std::find_if(m_connectors.begin(), m_connectors.end(), [output](const auto &conn) {
                 return conn.get() == output->connector();
             });
             Q_ASSERT(it != m_connectors.end());
             m_connectors.erase(it);
-            removeOutput(output);
         }
         QTimer::singleShot(50, m_platform, &DrmBackend::updateOutputs);
     } else {